PT-2022-21903 · Mantisbt · Mantisbt

Devendra Bhatla + 1 · Published 2022-06-24 · Updated 2022-07-06 · CVE-2022-33910

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.25.5

Description The issue allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file download.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScript code to execute.

Recommendations For versions prior to 2.25.5, update to version 2.25.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the file download.php endpoint to minimize the risk of exploitation. Avoid opening attachments from untrusted sources until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-33910

GHSA-QGHG-V7XV-Q98Q

Affected Products

Mantisbt

References · 9

• 🔥 https://mantisbt.org/bugs/view.php?id=29135 · Exploit
• 🔥 https://mantisbt.org/bugs/view.php?id=30384 · Exploit
• https://mantisbt.org/blog/archives/mantisbt/719 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-33910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33910 · Security Note
• https://osv.dev/vulnerability/GHSA-qghg-v7xv-q98q · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/266762193fc6c09ffc6b14f5a34c86eae3ebee20 · Note
• https://t.me/cibsecurity/45106 · Telegram Post